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At Salesforce, Trust is our #1 value. We extend this value not just to our customers, but to you and 
our entire Salesforce family. We are committed to protecting your personal data, and maintaining 
your Trust in how we collect, process, and handle that data. Protecting your privacy is very important 
to us, and central to the entire Salesforce family. 


This privacy statement describes the handling of personal data obtained about internal and external 
job applicants, including referrals and applicants who have applied directly through the Salesforce 
online recruitment system and careers page (the "recruitment system") as well as through third party 
agencies and recruiters on behalf of candidates. It also describes the handling of personal data of 
any prospective candidates or leads, such as those individuals who expressed an interest in 
receiving news and details about future Salesforce opportunities or other related communications. 
Personal data is information, or a combination of pieces of information, that could reasonably allow 
you to be identified. 


This privacy statement describes how Salesforce.com, Inc. and its local affiliate relevant to the job in 
question (“we”, “us”, or “Salesforce”) collect and process personal data about you, how we use and 
protect this information, and the rights that may be available to you under applicable law regarding 
this information. A list of Salesforce’s affiliates can be found in the List of Subsidiaries section of 
Salesforce’s most recent Form 10-K, available under the “Quarterly Filing” page located here. If you 
are applying for a role in the Japan organization, please also see the (LA IS#i (78a i 


1. PERSONAL DATA WE USE 


We will collect your personal data from you directly and potentially from other sources. 


1.1 Data we collect directly from you 


The categories of data that we collect directly from you include: 


1) Identifiers: 

a) personal (e.g., name) and contact details (e.g., phone number, email address, postal 
address) 

b) username and password for the online recruitment system 

c) information about family and dependents (e.g., for relocation purposes) 

2) Professional and Employment-Related Information: 

a) information contained in your resume or CV, and other documents related to the 
application or recruitment process (e.g., cover letter, transcripts, certifications) 

b) other information you may choose to voluntarily submit to us in connection with your 
application (e.g., information contained in a cover letter, information disclosed in an 
interview or information you volunteer regarding your criminal records history, 
compensation history, family history or personal situation) 

c) debarment, suspension or related information as it relates to an award for a contract 
from a US federal agency or relevant licenses 

3) Educational Information: 

a) educational details (e.g., educational history, qualifications, certifications, skills) and 

job history (e.g., previous employment, roles, performance history) 
4) Electronic, Visual and Audio Information 

a) on-premise location monitoring for security purposes (e.g., video surveillance when 

attending our premises for an interview) 
5) Internet Activity Information: 

a) information about you using cookies and similar technologies when you use the 
recruitment system and browse our website (see our Privacy Statement for further 
information about how this works) 


1.2 Data we collect from other sources 


We may collect the following data about you from other sources: 


1) Professional and Employment-Related Information: 

a) background check data, potentially including your criminal records history, 
employment history, educational history and/or compensation history, from 
employment screening agencies, publicly available registers or databases, former 
employers and/or educational institutions (as allowed by local laws) 

b) information about your performance or conduct from references, other Salesforce 
employees, clients or service providers, or current or former employers who may 
provide feedback about you 

c) information about you from Salesforce employees who interview you and who may 
provide feedback about you 


2) Internet Activity Information: 


a) publicly available information from websites or social media, including information 
that you choose to voluntarily submit to us in connection with your application (e.g., 
when applying through LinkedIn) 


1.3 Sensitive personal data 


We may collect sensitive or special category data about you, as permitted or required by local laws. 
Sensitive data is personal data that may have special protection under certain data protection laws. 
We consider the following categories of data as sensitive data that we collect for the following 
reasons, to the extent legally allowed or for the purposes of complying with local laws: 


e data related to diversity (e.g., race, ethnicity, gender, religion, veteran status and/or 
disabilities) 

e citizenship or immigration information (e.g., for visa purposes, right to work information) 

e information about any health issues or disabilities (e.g., your disability status, any requests 
for accommodation in the application or interview process) 

e information about your health status, where appropriate (e.g., confirmation of your wellness 
before attending an in-person interview) 

e your trade union, works council membership or employee representative status, if you 
disclose this in your resume or during the interview process 


We may also collect any sensitive data that you voluntarily disclose, including the information 
described above and other information like your political opinions or religious or philosophical beliefs. 


If we request your explicit consent to collect sensitive data about you, you have the right to withdraw 
that consent at any time by contacting us at privacy@salesforce.com (not all the categories 
mentioned above require your consent). 


2. HOW WE USE YOUR PERSONAL DATA AND THE BASIS ON WHICH WE USE IT 


We limit our use of your personal data. We aim to only collect and use your personal data for 
specific, necessary reasons and aim to explain our use of your personal data. For example, we use 
your personal data to: 


(a) create and manage the recruitment system, job applications and a database of interested 
individuals and leads 


(b) assess and evaluate your skills, qualifications and interests against the position applied 
for and/or other positions within Salesforce 


(c) communicate with you about your expressed interest in Salesforce, job 
opportunities/leads, application or the recruitment process 


(d) verify your information, including through reference checks and, where applicable, 


background checks 


(e) send you information about the new hire and employee experience at Salesforce before 
your first day 


(f) with your consent, send you information about positions within Salesforce which may be 
of interest to you 


(g) operate, evaluate and improve the recruitment system, our application tracking and 
recruitment activities (this includes analyzing our job applicant base, our hiring practices 
or trends, identifying qualification or skill shortages, and using information to match 
candidates and potential opportunities) 


(h) detect, prevent and respond to fraud or potentially illegal activities (such as intellectual 
property infringement), and misuse of the recruitment system or other applicable policies 


(i) perform audits, assessments, maintenance and testing or troubleshooting activities related 
to the recruitment system and our recruitment processes 


(j) comply with legal obligations to which we are subject and cooperate with regulators and 
law enforcement bodies 


(k) respond to your enquiries and requests 


We must have a legal basis to process your personal data. In most cases the legal basis will be one 
or more of the following: 


(a) to comply with our contractual obligations to you or to take steps to enter into a contract 
with you 


(b) to comply with our legal obligations 
(c) your consent 


(d) to meet our legitimate interests, for example to conduct our recruitment processes 
efficiently and fairly or to manage applications effectively. When we process personal 
data to meet our legitimate interests, we put in place safeguards to ensure that our 
legitimate interests do not override your privacy and other fundamental rights and 
freedoms. 


When we are required by local law to collect certain personal data about you, your failure to provide 
this data may prevent or delay the fulfillment of our legal obligations and may impact our ability to 


employ you. If we ask for your consent to process your personal data, you may withdraw your 
consent at any time by contacting us using the details at the end of this privacy statement. 


3. YOUR RIGHTS OVER YOUR PERSONAL DATA 


You have certain rights regarding your personal data, subject to applicable local laws. These include 
the following rights to: 


e access your personal data 


e fix any errors in your personal data 


e erase or delete your personal data 


e restrict our use of your personal data 


e object to our use of your personal data 


e receive your personal data in a usable electronic format and transmit it to a third party (right to 
data portability) 


e know what categories of personal data are shared for delivering advertisements on 
non-Salesforce websites, applications, and services and the categories of recipients of such 
personal data 


e opt out of the sharing of your personal data for delivering advertisements on non-Salesforce 
websites, applications, and services 


e lodge a complaint with your local data protection authority or regulatory body 


e not be discriminated against for exercising your rights described above 


If you would like to exercise any such right, please contact us at privacy@salesforce.com or call us at 
+1-855-938-34 10. 


We may need to verify your identity and place of residence before completing your request. We will 
reach out to you directly should we require additional information to verify your identity. 


If you are an authorized agent wishing to exercise rights on behalf of a California resident, please 
contact the Privacy Team at privacy@salesforce.com and provide a copy of the consumer’s written 
authorization designating you as their agent. 


If you would like to opt-out of shares using your cookie identifiers, turn on a Global Privacy Control in 
your web browser or browser extension. Please see the California Privacy Protection Agency’s 
website at https://oag.ca.gov/privacy/ccpa for more information on valid Global Privacy Controls. If 
you would like to opt-out of shares using other identifiers (like email address or phone number), 
please contact the Privacy team at privacy@salesforce.com. 


We encourage you to contact us to update or correct your information if it changes or if the personal 
data we hold about you is inaccurate. 


4. DECISIONS ABOUT YOUR APPLICATION 


The way we analyze your personal data for the purposes of reviewing your application may involve 
the use of a tool that compares the candidate profile contained in your application against the profile 
of the job you applied for. Please note that use of such a tool is only one component of our hiring 
process and if a decision is made to hire a candidate, a recruiter will always be involved in reviewing 
the application. 


Separately, please also note your application may be automatically rejected, without human review, 
if an open role is filled while you are still in the recruitment process or if you do not meet the 
minimum job requirements. 


Subject to local legal requirements and limitations, you can object to our use of, and exclude yourself 
from, these tools through this form, and you may also contact us at privacy@salesforce.com to 
request further information, or where applicable, request a review by a human. 


5. DATA SHARING 


While we do not sell or market your personal data, we may share your personal data with third 
parties in limited situations, including with: 


e Salesforce group companies. We may share your personal data with other companies that 
fall within the Salesforce group, for example for recruitment purposes, human resource 
management and internal reporting. 


e Service providers and business partners. We may share your personal data with our 
service providers and business partners that perform business operations for us. For 
example, we may partner with other companies to host the recruitment system and analyze 
data to improve performance or engage third parties to audit our systems, products or 
practices. 


e Law enforcement agencies, courts, regulators, tax authorities, government authorities 
or other third parties. We may share your personal data with these parties if necessary to 


comply with a legal or regulatory obligation, or otherwise to protect our rights, your rights or 
the rights of any third party. 


We may also share your personal data (in the form of identifiers and internet activity information) 
with third party advertisers for purposes of targeting advertisements on non-Salesforce websites, 
applications, and services. In addition, we may allow third parties to collect personal data from our 
sites or services if those third parties are authorized service providers who have agreed to our 
contractual limitations as to their retention, use, and disclosure of such personal data, or if you use 
Salesforce sites or services to interact with third parties or direct us to disclose your personal data to 
third parties. 


6. DATA SECURITY 


Security is an integral part of our business model and we put significant resources into making sure 
your data is protected. This involves technical measures (such as implementing security software) 
and organizational measures (such as only allowing staff to access your data if there is a business 
need to do so). These measures are aimed at ensuring the on-going integrity and confidentiality of 
personal data. We evaluate these measures regularly. 


We will keep your personal data until the position you are applying for has been filled, after which we 
will retain your personal data for a period of time that enables us to: 


e Maintain business records for analysis, understanding market trends and/or audit purposes. 


e Comply with record retention as required by local law or other relevant legal or regulatory 
requirements. 


e Defend, establish, exercise or bring any existing or potential legal claims. 


e Ensure fraud detection and prevention. 


e Respond to any queries or complaints you may have. 


e With your consent, suggest roles and career information that may be of interest to you. 


We will delete your personal data when it is no longer required for these purposes. If there is any 
personal data that we are unable, for technical reasons, to delete entirely from our systems, we will 
ensure that appropriate measures are taken to prevent any further processing or use of the personal 
data. 


7. INTERNATIONAL DATA TRANSFER 


Because we operate as part of a global business, we may transfer, store, or process your personal 
data in a country different from where you reside. Your personal data may be processed in countries 
that are not subject to an adequacy decision by the European Commission or your local legislature 
or regulator, and that may not provide for the same level of data protection as your jurisdiction. In 
these instances, we put in place appropriate safeguards (such as the Standard Contractual Clauses) 
to ensure that your personal data is adequately protected. 


Further, Salesforce commits to comply with the EU-U.S. Data Privacy Framework, the Swiss-U.S. 
Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework 
(collectively, the “DPF”) and certifies its adherence to the DPF Principles as set forth by the U.S. 
Department of Commerce, including the onward transfer liability provision, regarding the processing 
of your personal data transferred to the U.S. in reliance on the DPF. Salesforce’s commitments 
under the DPF are subject to the investigatory and enforcement powers of the U.S. Federal Trade 
Commission. If you have any questions or concerns regarding our handling of your personal data, 
please contact us using the contact information provided below. Salesforce commits to cooperate 
and comply with the advice of the panel established by the EU data protection authorities, the UK 
Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA), and the 
Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved 
complaints concerning our handling of your personal data received in reliance on the DPF. If neither 
Salesforce nor the panel established by the above mentioned EU data protection authorities resolve 
your complaint, you may have the possibility to engage in binding arbitration through the Data 
Privacy Framework Panel. For more information on this option, please see Annex | of the EU-U.S. 
Data Privacy Framework Principles. 


Salesforce also adheres to the APEC Cross Border Privacy Rules (CBPR) system. Our full notice 
can be referenced on our website here. If you have an unresolved privacy or data use concern that 
we have not addressed to your satisfaction, please contact our third party dispute resolution provider 


(free of charge) at https://trustarc.com/dispute-resolution/. 


If you reside in the People’s Republic of China, we may transfer your data outside of China, in 
accordance with applicable law. 


8. CONTACT US AND CHANGES TO THE PRIVACY STATEMENT 


If you have questions or concerns regarding the way in which your personal data has been used or 
about this privacy notice, please contact the Privacy Team at privacy@salesforce.com. 


We are committed to working with you to obtain a fair resolution of any complaint or concern about 
privacy you may have. If, however, you believe that we have not been able to assist with your 
complaint or concern, you have the right to make a complaint to the local data protection authority or 
regulatory body in the country where you reside. If you reside in a country that is a member of the 
European Union or that is in the European Economic Area, you may find the contact details for your 
appropriate data protection authority on the following website. 


We may modify or update this privacy statement from time to time. If we make a material change to 


this privacy statement, we will notify you of the change. 
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